You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

25 lines
1.1 KiB

From 17f487b7afa7cd6c316040f3e6c86dc96b2eec30 Mon Sep 17 00:00:00 2001
From: DJ Delorie <dj@delorie.com>
Date: Fri, 17 Mar 2017 15:31:38 -0400
Subject: [PATCH] Further harden glibc malloc metadata against 1-byte
overflows.
Additional check for chunk_size == next->prev->chunk_size in unlink()
2017-03-17 Chris Evans <scarybeasts@gmail.com>
* malloc/malloc.c (unlink): Add consistency check between size and
next->prev->size, to further harden against 1-byte overflows.
diff -rup a/malloc/malloc.c b/malloc/malloc.c
--- a/malloc/malloc.c 2017-08-01 18:11:00.000000000 -0400
+++ b/malloc/malloc.c 2017-08-01 18:13:07.907438098 -0400
@@ -1429,6 +1429,8 @@ typedef struct malloc_chunk* mbinptr;
/* Take a chunk off a bin list */
#define unlink(AV, P, BK, FD) { \
+ if (__builtin_expect (chunksize(P) != next_chunk(P)->prev_size, 0)) \
+ malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV); \
FD = P->fd; \
BK = P->bk; \
if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) { \